Malicious Code Detected in shopping-cart-service: Version 1.9.9 Vulnerability
Summary
MAL-2026-188: Malicious code in shopping-cart-service (npm). Affects shopping-cart-service versions 1.9.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'shopping-cart-service' is an npm package designed to facilitate e-commerce functionalities, allowing developers to integrate shopping cart features into their applications. It is widely used due to its ease of use and comprehensive features. However, version 1.9.9 has been identified as malicious, posing significant security risks to users and their applications.
Vulnerability Detail
The vulnerability stems from the package's communication with a domain linked to malicious activities and the execution of commands that are associated with harmful behavior. This could lead to unauthorized access, data breaches, or further exploitation of the affected systems. The OpenSSF Package Analysis project has flagged this version as malicious, indicating a serious threat to users who have integrated this package into their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall shopping-cart-serviceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'shopping-cart-service' package from your project until a secure version is confirmed. Use the command: npm uninstall shopping-cart-service. This will prevent any malicious code from executing while you seek a safer alternative.
Conclusion
The 'shopping-cart-service' version 1.9.9 has been flagged as malicious due to its harmful behavior and communication with malicious domains. It is essential for users to update or remove this package to protect their applications from potential threats. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for shopping-cart-service →
FAQ
The package communicates with a domain associated with malicious activities and executes commands that can compromise system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Currently, the malicious version is 1.9.9. It is recommended to update to the latest version of the package, which may contain security fixes.
As a workaround, you should uninstall the 'shopping-cart-service' package to prevent any malicious code from executing until a secure version is available.
The vulnerability was identified by the OpenSSF Package Analysis project, which specializes in analyzing open-source packages for security risks.
